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THE MAILING DATE OF THIS COMMUNICATION. 
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DETAILED ACTION 

1. This final office action is in response to amendment and remarks filed on September 20, 2004. 
Applicant's argument has been fully considered but they are not deemed to be persuasive. 
Claims 1, 4-11, 14-24 are currently pending in the application and are presented for examination. 

Claim Rejections - 35 USC § 103 

2. Following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness 
rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

3. Claims 1-24 are rejected under 35 U.S.C. 102(e) as anticipated by or, in the alternative, under 
35 U.S.C. 103(a) as obvious over Bullard (U.S. Pat. No. 6,625,657, from hereon Bullard). 

Per claims 1 and 11, Bullard teaches a method for profiling network flows at a measurement 
point within a computer network (system of Bullard, Abstract, receive network flow information 
from the network entities and to produce records based on the information, and col. 3, lines 27- 
36, The accounting process 14, as will be described in FIG. 2, has a core process that can handle 
profiling ), the method comprising: 

measuring network flows at a measurement point located within routing infrastructure of the 
computer network to obtain flow statistics (col. 6, lines 27-52, A data collector 52 can be 
disposed in the network in a path between the entities "A" and "B", such that the data collector 
52 monitors some of the packets that comprise a flow between "A" and "B ." As a single point 
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monitor, the data collector has no concept that there are two ends communicating, and for flow 
statistic, col. 22, line58, to col. 23, line 9); and 

aggregating the flow statistics to obtain a traffic profile of the network flows at the measurement 
point (col. 31, lines 7-40, DiffServ enabled networks classify packets into one of a small number 
of aggregated flows or "classes", based on bits set in the type of service (TOS) field of each 
packet's IP header. This is a quality of service technology for IP networking is designed to lower 
the statistical probability of packet loss of specific flows ). 

The reference Bullard, does not explicitly teach of network flow having invariant features. 
However, Bullard in col. 6, lines 27-53, teaches of data collector being modeled as a data 
collector develops a "connection oriented tracking", and the network can be modeled as pipes 
having two endpoints", and later in col. 2, lines 38-44 (different protocol types), and in col. 6, 
lines 15-26, port information (For example, a switch may have a number of Ethernet ports and a 
host could be connected to one of the ports and in communication with one of the interfaces to 
transfer information over the network) which are invariant for the reason to facilitates the end 
communication and data collector being able to communicate between these end point entities 
and gather information for profiling. Therefore, it would have been obvious for one ordinary skill 
in the art at the time the invention was made to use invariant features for the reason to facilitate 
the end communication and data collector being able to communicate between these end point 
entities and gather profiling information. 
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Per claims 2 and 12, The method as claimed in claim 1 wherein the step of aggregating is based 
on at least one of the invariant features (col. 15, lines 8-28, Recall that each equipment interface 
42a-42g is associated with an flow data collector. Thus, the combination of an equipment 
interface and a flow data collector support a particular device or technology and collects data 
from the particular device or technology using a pre-defined format, schedule and protocol 
specific to that device/technology). 

Per claims 3 and 13, the method as claimed in claim 2 wherein the at least one invariant feature 
is either a source endpoint or a destination endpoint and wherein the step of aggregating is based 
on distance of the measurement point From the endpoint (col. 7, lines 1-11, The data collector 52 
identifies a source and a destination of the traffic. That is, the data collector develops a 
"connection oriented tracking"). 

Per claims 4 and 14, the method as claimed in claim 1 wherein the invariant features include 
source and destination endpoints (col. 7, lines 1-11, source and destination endpoint). 

Per claim 5, the method as claimed in claim 4 further comprising identifying typical traffic 
source and destination pairs for network flows that transit the measurement point based on the 
source and destination endpoints. The reference of Bullard teaches of pipes having two endpoints 
and in any network including typical network (col. 7, lines 1-11). 
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Per claims 6 and 16, the method as claimed in claim 4 wherein the invariant features include 
protocol type (col. 2, lines 38-44, different protocol types). 

Per claims 7 and 17, the method as claimed in claim 6 where the invariant features include port 
information (col. 6, lines 15-26, port information (For example, a switch may have a number of 
Ethernet ports and a host could be connected to one of the ports and in communication with one 
of the interfaces to transfer information over the network). 

Per claims 8 and 18, the method as claimed in claim 1 wherein the step of aggregating is based 
on temporal, static network and dynamic routing parameters (col. 6, lines 27-52, For a router. 
normally an address of the object that is connected to that interface might serve as an address. A 
switch has an IP address that can be used as the destination. The actual device that is connected 
to the switch or router can be used as an accountable object. Although the traffic is not destined 
for the routen the data collector can use those identifiers as keys to the endpoints "A", "B.")- 

Per claims 9 and 19, the method as claimed in claim 1 further comprising identifying desired 
network flow characteristics based on dynamic routing and topology information (col. 21, lines 
26-36, ho w. aggregation is used to provide the data to meet the needs of a specific application. 
The aggregation performed by the different levels can also be remotely and independently 
adjusted, as will now be described). 
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Per claims 10 and 20, the method as claimed in claim 1 wherein the computer network is the 
Internet (col. 5, lines 18-39, Data is made available to the Internet service provider via the data 
distribution layer (FIG. 2) so that the Internet service provider can analyze data in order to 
differentiate service offerings to different users). 

Per claim 21, the method as claimed in claim 3 wherein level of route aggregation is a measure 
of the distance (col. 7, lines 1-1 1, the data collector 52 identifies a source and a destination of the 
traffic. That is, the data collector develops a "connection oriented tracking 5 '). 

Per claim 22, the method as claimed in claim 3 further comprising utilizing physical and logical 
router interfaces at a highest level of aggregation (col. 10, lines 27-42, a source and a destination 
identifier to the metric. In the example of a router link, the metrics that the router interface 
provides are in the form of "information in" and "information out" e.g., octets in, octets out, 
bytes in, bytes out datagrams in, datagrams out, faults in, faults out, and so forth). 

Per claim 23, the method as claimed in claim 3 wherein the distance is a logical distance with 
respect to forwarding topology (col. 7, lines 1-1 1, the data collector 52 identifies a source and a 
destination of the traffic. That is, the data collector develops a "connection oriented tracking"). 

Per claim 24, the system as claimed in claim 1 1 where the system is capable of adapting to 
system resources in a dynamic fashion by reassignment of system resources to deal with possible 
aggregation levels. The system of Bullard teaches of the limitation in Fig. 21 (FIG. 21 is a 
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hierarchical representation of an aggregation adjustment scheme for adjusting the aggregation 
activity at the levels of the flow aggregation processor and the data collectors). 

4. Applicant on page 5 of his remarks argues that: "by this Amendment Applicants' 
Attorney has amended each of the independent claims to make it clear that aggregating is based 
on at least one of the invariant features such as either a source endpoint or a destination endpoint 
and wherein aggregating is based on distance of the measurement point within the routing 
infrastructure from the endpoint so that the network flow is profiled at the measurement point 
within the routing infrastructure in proportion to the distance to the measurement point from the 
endpoint. Clearly, this feature is neither taught, disclosed nor discussed by any of the references 
of record taken either alone or in combination with one another including the U.S. Patent to 
Bullard. Support for this feature can be found on pages 16 and 17 of the specification". 

In response applicant's attention is directed to the rejection of claims 2, and 3 above for the 
limitations argued by Applicant. Bullard teaches of STR address and DST address in col. 8, lines 
39-40, and col. 10, lines 27-42. He also teaches of "connection oriented tracking", in col. 7, lines 
1-11 (The data collector 52 identifies a source and a destination of the traffic. That is, the data 
collector develops a "connection oriented tracking"). 

Conclusion 

5. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 C.F.R. § 1 . 136(a). 

A SHORTENED STATUTORY PERIOD FOR RESPONSE TO THIS FINAL ACTION 
IS SET TO EXPIRE THREE MONTHS FROM THE DATE OF THIS ACTION. IN THE 
EVENT A FIRST RESPONSE IS FILED WITHIN TWO MONTHS OF THE MAILING DATE 
OF THIS FINAL ACTION AND THE ADVISORY ACTION IS NOT MAILED UNTIL 
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AFTER THE END OF THE THREE-MONTH SHORTENED STATUTORY PERIOD, THEN 
THE SHORTENED STATUTORY PERIOD WILL EXPIRE ON THE DATE THE 
ADVISORY ACTION IS MAILED, AND ANY EXTENSION FEE PURSUANT TO 37 C.F.R. 
§ 1.136(a) WILL BE CALCULATED FROM THE MAILING DATE OF THE The application 
has been amended as follows: 

ADVISORY ACTION. IN NO EVENT WILL THE STATUTORY PERIOD FOR RESPONSE 
EXPIRE LATER THAN SIX MONTHS FROM THE DATE OF THIS FINAL 



6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Majid A. Banankhah whose telephone number is (571) 272- 
3770. The examiner can normally be reached on Monday - Thursday, 8:00 AM - 4:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Meng-Ai An can be reached on (571) 272-3756. 

Information regarding the status of an application may be obtained from the patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http ://pair-direct uspto . gov . Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll free). 

Majid A. Banankhah 
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